The number of cyber-attacks around the world exploded in 2020: exploiting the Covid-19 pandemic as an opportunity for cybercriminals to take advantage of the shift in focus towards smart working and hospital staff transferred to the frontline.
In November 2016, ENISA publicshed its key recommendations for hospital information security executives and industry to enhance the level of information security in Smart Hospitals.
Smart hospitals refer to the adoption of Internet of Things (IoT) components to support the core functions of a hospital. Collaboration among various stakeholders, numerous interconnected assets and high flexibility requirements not only lead to a complex and dynamic environment but also to blurred organisational boundaries.
Due to the great number of significant assets at stake (patient life, sensitive personal information and financial resources) information security is a key issue for smart hospitals. Threats to smart hospitals are, however, not limited to malicious actions in terms of their root cause. Human errors and system failures as well as third-party failures also play an important role. The risks that result from these threats and corresponding vulnerabilities are typically mitigated by combining organisational and technical security measures taken by smart hospitals.
With respect to organisational measures, compliance with standards, staff training and awareness raising, a sound security organisation, and the use of guidelines and good practices are particularly relevant. Relevant technical measures include network segmentation, asset and configuration management, and network monitoring and intrusion detection. However, manufacturers of information systems and devices used in smart hospitals have to take certain measures too. Among them are, for instance, building security into products from the outset, adopting secure coding practices and extensive testing.
Based on the analysis of documents, empirical data, and a detailed examination of attack scenarios particularly relevant for smart hospitals, the study proposes key recommendations primarily for hospital executives:
The study also makes recommendations for industry representatives in order to enhance the level of information security in smart hospitals. Namely industry players should:
PANACEA Research perspectives: PANACEA is developing a toolkit with technological, human and organisational elements fit for the digitisation of healthcare providing measures to counteract cyber risks in the sector and build stronger defences. The on-going work by ENISA is a major reference point for PANACEA also as it continuously analyses the policy and regulatory environment and matches its toolkit assets with good practices in the area of cybersecurity.
Lookout Watch entry date: 07/08/2019